Privacy Policy

Halo Medical Solutions, Inc. ("Halo", "Company", "we", "us" or "our") is committed to protecting the privacy and security of your information. This Privacy Policy describes how we collect, use, disclose, and safeguard information when you use our AI-powered clinical documentation platform, application, APIs, and related services (collectively, the "Services").

Our Services are designed for healthcare providers, telehealth companies, and related organizations. We understand the sensitive nature of the information processed through our platform—including Protected Health Information ("PHI")—and we are committed to handling it in accordance with the Health Insurance Portability and Accountability Act ("HIPAA"), applicable state privacy laws, and industry best practices.

By accessing or using our Services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with this Privacy Policy, please do not use the Services.

1. Information We Collect

1.1 Account Information

When you register for an account, we collect information such as your name, email address, professional credentials, organization name, and billing information. This information is necessary to create and manage your account, verify your identity, and process payments.

1.2 Clinical Data and Protected Health Information

In the course of providing our AI scribe and clinical documentation Services, we may process the following types of information on your behalf:

• Audio recordings — real-time audio captured during clinical encounters for the purpose of transcription and note generation;
• Transcriptions — text generated from audio recordings of patient-provider conversations;
• Clinical notes — AI-generated and provider-edited documentation including SOAP notes, assessments, and other structured medical records;
• Patient information — any patient-identifiable information contained within recordings, transcriptions, or notes processed through the Services.

This clinical data may constitute Protected Health Information ("PHI") under HIPAA. Our handling of PHI is governed by our Terms of Service and the Business Associate Agreement ("BAA") executed between Halo and the applicable Covered Entity.

1.3 Usage and Technical Data

We automatically collect certain technical information when you use the Services:

• Device type, operating system, and browser information;
• IP address and approximate geographic location;
• Usage patterns such as features accessed, session duration, and interaction data;
• Error logs and performance metrics.

This data is collected to maintain and improve the Services, diagnose technical issues, and ensure platform security. Technical data is not linked to patient information or PHI.

1.4 Communication Data

When you contact us for support or provide feedback, we collect the content of your communications, including email messages, support tickets, and any attachments you provide.

2. How We Use Your Information

We use the information we collect for the following purposes:

2.1 Providing the Services

• Processing audio recordings through our speech-to-text systems;
• Generating, structuring, and formatting clinical documentation using AI;
• Enabling you to review, edit, and manage clinical notes;
• Managing your account, authentication, and access permissions;
• Processing payments and managing your subscription.

2.2 Improving the Services

• Analyzing aggregated, de-identified usage data to improve our AI models, accuracy, and features;
• Identifying and resolving bugs, errors, and performance issues;
• Developing new features and functionality.

We do not use identifiable PHI to train or improve our AI models. Any data used for model improvement is first de-identified in accordance with 45 CFR §164.514(b).

2.3 Security and Compliance

• Detecting, preventing, and responding to security threats and fraud;
• Maintaining audit logs as required by HIPAA and other regulations;
• Complying with legal obligations and responding to lawful requests.

2.4 Communications

• Sending service-related notifications, updates, and security alerts;
• Responding to your inquiries and support requests;
• Providing information about changes to our Services, terms, or policies.

3. How We Share Your Information

We do not sell, rent, or trade your personal information or PHI. We may share information in the following limited circumstances:

3.1 Service Providers and Subprocessors

We engage trusted third-party service providers to assist in delivering the Services, including cloud infrastructure providers, payment processors, and AI/ML service providers. All subprocessors with access to PHI are bound by Business Associate Agreements and are required to implement appropriate safeguards.

3.2 Legal Requirements

We may disclose information if required to do so by law, regulation, legal process, or governmental request, including to meet national security or law enforcement requirements.

3.3 Business Transfers

In the event of a merger, acquisition, reorganization, or sale of assets, your information may be transferred as part of the transaction. We will notify you of any such change and ensure that the receiving entity is bound by the terms of this Privacy Policy and applicable BAA.

3.4 With Your Consent

We may share your information with third parties when you have given us explicit consent to do so.

4. Data Security

We implement comprehensive administrative, technical, and physical safeguards designed to protect your information and PHI. These measures include:

• Encryption — all data is encrypted in transit (TLS 1.2+) and at rest (AES-256);
• Access controls — role-based access controls and multi-factor authentication for system access;
• Audit logging — comprehensive logging of access to and modifications of PHI;
• Infrastructure security — hosted on HIPAA-compliant cloud infrastructure with regular security assessments;
• Employee training — all personnel with access to PHI receive HIPAA training and are bound by confidentiality obligations.

While we take extensive measures to protect your data, no method of electronic transmission or storage is completely secure. We cannot guarantee absolute security but are committed to promptly addressing any security incidents in accordance with our Breach Notification procedures and applicable law.

5. Data Retention and Deletion

We retain your information for as long as necessary to provide the Services, comply with legal obligations, resolve disputes, and enforce our agreements.

• Account data — retained for the duration of your account and deleted upon account termination, subject to legal retention requirements;
• Clinical data and PHI — retained in accordance with your instructions and the BAA. Upon termination, PHI is returned or destroyed per the terms of the BAA;
• Audio recordings — audio data is processed for transcription and is not retained beyond the period necessary to deliver the transcription service, unless otherwise specified;
• Usage data — aggregated and de-identified usage data may be retained indefinitely for analytics and service improvement.

You may request deletion of your data at any time by contacting us at keshav@halohealth.app. We will process deletion requests in accordance with applicable law and the terms of any applicable BAA.

6. Your Rights and Choices

Depending on your jurisdiction, you may have certain rights regarding your personal information:

• Access — you may request a copy of the personal information we hold about you;
• Correction — you may request that we correct inaccurate or incomplete personal information;
• Deletion — you may request that we delete your personal information, subject to legal retention obligations;
• Data portability — you may request a copy of your data in a structured, machine-readable format;
• Opt-out — you may opt out of non-essential communications at any time.

For rights related to PHI, the applicable Covered Entity (your healthcare provider or organization) is the data controller. Requests concerning access to, amendment of, or accounting of disclosures of PHI should be directed to the Covered Entity. We will cooperate with the Covered Entity to fulfill such requests in accordance with HIPAA.

To exercise any of these rights, please contact us at keshav@halohealth.app.

7. HIPAA and PHI Processing

When we process PHI on behalf of a Covered Entity, we do so as a Business Associate under HIPAA. Our obligations regarding PHI are governed by the Business Associate Agreement attached as Appendix I to our Terms of Service.

Key commitments regarding PHI:

• We only use and disclose PHI as permitted by the BAA, the HIPAA Privacy Rule, and applicable law;
• We apply the minimum necessary standard to all uses and disclosures of PHI;
• We maintain comprehensive audit trails for all access to and disclosures of PHI;
• We promptly report any Breach of Unsecured PHI or Security Incident as required by the BAA and the HIPAA Breach Notification Rule;
• We ensure all subcontractors with access to PHI are bound by equivalent contractual obligations.

8. AI and Automated Processing

Our Services use artificial intelligence and machine learning technologies to process audio recordings, generate transcriptions, and produce clinical documentation. You should be aware of the following:

• AI-generated content is intended to assist healthcare providers and is not a substitute for professional clinical judgment;
• Providers are responsible for reviewing and approving all AI-generated documentation before use in patient care;
• We do not use identifiable PHI to train general-purpose AI models;
• Audio and text data are processed using secure, HIPAA-compliant AI infrastructure;
• We may use de-identified and aggregated data to improve the accuracy and performance of our models, in compliance with 45 CFR §164.514(b).

9. Cookies and Tracking Technologies

We use cookies and similar technologies to operate the Services, maintain your session, remember your preferences, and analyze usage patterns. The types of cookies we use include:

• Essential cookies — required for the operation of the Services, including authentication and security;
• Functional cookies — used to remember your preferences and settings;
• Analytics cookies — used to understand how the Services are used, in aggregated and de-identified form.

We do not use advertising or third-party tracking cookies. You can control cookie preferences through your browser settings, though disabling essential cookies may affect the functionality of the Services.

10. Children's Privacy

The Services are not directed to individuals under the age of 18 and are intended for use by licensed healthcare professionals and authorized staff. We do not knowingly collect personal information from children. If we become aware that we have collected personal information from a child under 18, we will take steps to delete such information promptly.

Note that the Services may process PHI relating to minor patients as part of clinical documentation. Such processing is governed by HIPAA and the applicable BAA, and is performed on behalf of and at the direction of the Covered Entity.

11. Third-Party Services

The Services may contain links to third-party websites or integrate with third-party services. This Privacy Policy does not apply to third-party services, and we are not responsible for their privacy practices. We encourage you to review the privacy policies of any third-party services you access.

12. State-Specific Privacy Rights

12.1 California Residents

If you are a California resident, you may have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA), including the right to know what personal information we collect, the right to delete personal information, the right to opt-out of the sale of personal information, and the right to non-discrimination for exercising your rights. We do not sell personal information as defined under the CCPA/CPRA.

12.2 Other State Laws

Residents of states with comprehensive privacy laws (such as Virginia, Colorado, Connecticut, and others) may have additional rights under applicable state law. Please contact us to exercise any rights available to you under your state's privacy laws.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the Services, or applicable law. When we make material changes, we will notify you by updating the "Last Updated" date at the top of this page and, where appropriate, providing additional notice through the Services or via email.

Your continued use of the Services after any changes to this Privacy Policy constitutes your acceptance of the updated policy. We encourage you to review this Privacy Policy periodically.

14. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: